👉 What’s the latest in the cyber world today?
Hackers Exploit Google Calendar, Jupyter Infostealer Resurfaces, Android Threat Circumvents Google’s Security Safeguards, Critical Vulnerabilities in Veeam ONE, Guidelines for Vulnerability Exploitability eXchange, QNAP Security Flaws, Ransomware Attack on Canadian Hospitals, Fake Ledger Live App, $770,000 Crypto Theft, Pro-Palestinian Hackers, Marina Bay Sands Exposes 665,000 Customers’ Data, North Korea’s Cyber Threats, Chinese Firms Dominate Cybersecurity Patents, Palo Alto Networks Acquires Talon, Gaps in Cloud Native Development, Liechtenstein’s AI Chatbot Guidelines.
🚨 Cyber Alerts
1. Threat Actors Exploit Google Calendar
Google is sounding the alarm on multiple threat actors who are sharing a public proof-of-concept exploit named Google Calendar RAT, which misuses Google Calendar Events for command-and-control operations. Developed by MrSaighnal, the script creates a ‘Covert Channel’ by manipulating Google Calendar event descriptions, enabling direct connections to Google.
2. Evolving Jupyter Infostealer Threat
A recently updated version of the Jupyter Infostealer, also known as Polazert, SolarMarker, and Yellow Cockatoo, has emerged with subtle yet effective changes designed to establish a discreet and persistent presence on compromised systems. This iteration employs PowerShell command alterations and private key signatures to make the malware appear as a legitimately signed file. Jupyter Infostealer has a history of utilizing manipulated search engine optimization tactics and malvertising to trick users into downloading it.
3. SecuriDropper Android Threat
Cybersecurity researchers have unveiled a new Android dropper-as-a-service named SecuriDropper, which cleverly sidesteps Google’s latest security barriers to deliver malware. Dropper malware acts as an intermediary for installing payloads on compromised devices, providing a profitable model for cybercriminals to market their capabilities to other criminal groups.
4. Veeam ONE Critical Vulnerabilities Patched
Veeam has released crucial hotfixes to address four vulnerabilities in its IT infrastructure monitoring platform, Veeam ONE, with two of them being rated as critical due to their potential for remote code execution and NTLM hash theft. The vulnerabilities affected actively supported Veeam ONE versions, up to the latest release, requiring admins to apply the provided hotfixes by replacing files on impacted servers and restarting services. Veeam urged administrators to apply the patches promptly to enhance the security of their infrastructure.
5. CISA’s Insights into VEX Information Release
The Cybersecurity and Infrastructure Security Agency has released a valuable resource titled “When to Issue Vulnerability Exploitability eXchange Information,” developed collaboratively by industry and government experts. This guide is designed to provide structure and guidance to the software security landscape, particularly within the global Software Bill of Materials community.
6. QNAP’s Urgent Security Updates
QNAP has acted swiftly to address two critical security flaws threatening its operating system, which, if exploited, could lead to arbitrary code execution. The vulnerabilities, tracked as CVE-2023-23368 and CVE-2023-23369, posed a significant risk to QNAP’s QTS, QuTS hero, QuTScloud, Multimedia Console, and Media Streaming add-on users. With ransomware attacks targeting NAS devices in the past, users are strongly encouraged to update to the latest versions to enhance their security and protect their network-attached storage systems.
7. Canadian Hospitals’ Ransomware Data Breach
Five Canadian hospitals, including Bluewater Health and Chatham-Kent Health Alliance, have confirmed that patient and employee data, totaling around 5.6 million patient visits and 267,000 unique patients, was stolen in a ransomware attack and later leaked online. While the affected hospitals are working to identify the impacted individuals and investigate the extent of the breach, the Daixin ransomware gang has claimed responsibility for the attack, exposing thousands of personally identifiable information and protected health information records. The hospitals have assured that no banking information was stolen in the incident, and investigations are ongoing.
8. Fake Ledger Live App Leads to $770,000 Hack
A fraudulent Ledger Live app on the Microsoft app store allowed hackers to steal 16.8 bitcoin, totaling $770,000 when including Ethereum and BNB Smart Chain. The hacker received these funds through multiple Bitcoin transactions and attempted to cover their tracks by splitting them across various wallets. This incident underscores the need for increased vigilance and security measures in the face of rising cryptocurrency-related hacks during asset price surges.
9. Soldiers of Solomon’ Hack Food Supply
In a concerning development, the Pro-Palestinian hacker group known as the ‘Soldiers of Solomon’ has claimed responsibility for infiltrating the infrastructure of Flour Mills Ltd, a multinational company specializing in flour processing and food products. The hackers assert that they have caused damage to the plant’s production cycle, potentially impacting the food supply chain. The incident follows the group’s recent cyber attack on the Ashalim Power Station and an extensive data breach in the Nevatim military area, highlighting the persistent threats posed by these hacktivists.
10. Marina Bay Sands Data Breach
Marina Bay Sands recently revealed a data security breach in which the personal information of 665,000 customers was accessed without authorization. The breach occurred in October, impacting some Sands LifeStyle rewards program members. The exposed data included names, email addresses, phone numbers, country of residence, membership numbers, and tiers. Marina Bay Sands assured affected customers that their personal data was not compromised, and investigations indicated that the breach only affected non-casino rewards program members.
11. US, South Korea, Japan Join Forces
In response to the increasing cyber threats posed by North Korea, the United States, South Korea, and Japan have established a high-level consultative body focused on cybersecurity matters. This group, which will convene quarterly, aims to bolster joint capabilities to address global cyber threats effectively. Their primary focus is to block cyber activities that provide significant funding for North Korea’s weapons development, including nuclear weapons and weapons of mass destruction.
12. China Dominates Cyber Patents
Chinese companies, including Huawei and Tencent, now hold the majority of the top patent positions in the global cybersecurity technology sector, according to a report by Nikkei Asia. Data compiled in collaboration with U.S. information services provider LexisNexis revealed that six of the top 10 global patent holders in this field were Chinese firms as of August, with IBM leading the list at 6,363 patents, followed by Huawei and Tencent with 5,735 and 4,803 patents, respectively.
13. Palo Alto Acquires Talon Cyber Security
Palo Alto Networks is aggressively expanding its presence in the cloud data security space with the acquisition of Talon Cyber Security for $625 million, following its recent purchase of Dig Security for $400 million. The acquisitions are part of Palo Alto’s efforts to bolster its enterprise cloud data security offerings and compete with rivals like Cisco.
14. Security Concerns in Cloud Native
A recent study by Venafi highlights the increasing security blind spots created by cloud native development practices in the US, UK, France, and Germany. The report, “The Impact of Machine Identities on the State of Cloud Native Security in 2023,” is based on a survey of 800 security and IT leaders in large organizations. It discloses that 59% of respondents have encountered security incidents in their Kubernetes or container environments, with network breaches, API vulnerabilities, and certificate misconfigurations being the primary causes.
15. Liechtenstein AI Chatbot Data Guidelines
The data protection regulator of Liechtenstein has released new guidelines for data processing, focusing on AI chatbots powered by large language models like ChatGPT. The guidance specifies that AI chatbots must adhere to GDPR transparency and consent clauses when handling user data, cookies, and sensitive information. It emphasizes the need for obtaining user consent and may require separate consent for specific data processing purposes, particularly related to advertising.
